Privacy policy

Your institution is the data controller. Edus processes student and staff records on its instructions and does not decide on its own what happens to them.

That means access requests, corrections and deletions go through your campus admin first. We act on their verified instruction.

Account data (name, institutional email, role, staff or student ID), the academic and administrative records your institution enters, and technical logs — sign-in times, IP address, browser and the pages you open.

We do not collect payment card details; billing is handled by your institution’s finance office.

To provide the service your institution has contracted for, to keep accounts secure, to meet the reporting duties institutions have to their regulators, and to fix faults.

We do not sell personal data, and we do not use student records to target advertising.

The assistant, timetable suggestions and voice minutes process the records you point them at. Outputs are drafts for a human to approve — nothing is actioned automatically.

Your institution’s data is not used to train shared models.

Other users at your institution, according to their role. Cloud hosting, email delivery and error-monitoring providers act as our processors under contract.

We disclose data to authorities only where the law requires it, and tell your institution unless we are barred from doing so.

Records live as long as your institution’s contract, then for the statutory retention period that applies to student records in your jurisdiction. Technical logs are kept for 90 days.

Access, correction, deletion, restriction, portability and objection, exercised through your campus admin. Where your institution cannot act, write to privacy@edus.example.

Encryption in transit and at rest, role-based access control, audited administrative actions, and password policy enforced server-side. Report anything suspicious via Get help.